{"id":"CVE-2026-124437","kind":"vulnerability","aliases":["CVE-2026-124437"],"related":[],"title":"Scriban: untrusted templates can exhaust memory and CPU, stalling hosts","description":"Scriban before 7.5.3 contains a resource exhaustion vulnerability that allows untrusted template authors to exhaust memory and CPU because builtins like math.format, regex.replace and string.escape skip the LimitToString allocation guard. Attackers can submit small templates using huge format precision specifiers, shared-structure array comparison, BigInteger multiplication or exponential function recursion that ignore LoopLimit and CancellationToken, crashing or stalling multi-tenant hosts.","summary":"Scriban is a .NET template engine; before 7.5.3 several builtins such as math.format, regex.replace and string.escape skip size and loop limits. A template author can submit a small template that drives memory and CPU use high enough to crash or stall the host.","severity":"high","cvss":8.7,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["dotnet","multi-tenant","package","scriban","self-hosted"],"not_affected_if":["scriban-not-used","trusted-templates-only"],"how_to_check":"- Find the Scriban package version in your .NET project files (look for `Scriban` in the .csproj or packages.lock.json) and check whether it is below `7.5.3`.\n- Check whether your application renders templates written by users or tenants you do not fully trust.","fix":"- Scriban: move to `7.5.3` or later","status":"open","published_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","triaged_at":"2026-11-08T14:49:07+00:00","updated_at":"2026-11-08T14:49:07+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-08T14:49:07Z","model":"claude-haiku-5-5","output":{"fix":"- Scriban: move to `7.5.3` or later","reach":"network","title":"Scriban: untrusted templates can exhaust memory and CPU, stalling hosts","impact":"medium","summary":"Scriban is a .NET template engine; before 7.5.3 several builtins such as math.format, regex.replace and string.escape skip size and loop limits. A template author can submit a small template that drives memory and CPU use high enough to crash or stall the host.","audience":"developers","category":"package","nicknames":[],"who_cares":["dotnet","scriban","multi-tenant","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Host process crashes or stalls from memory and CPU exhaustion","analyst_note":"","how_to_check":"- Find the Scriban package version in your .NET project files (look for `Scriban` in the .csproj or packages.lock.json) and check whether it is below `7.5.3`.\n- Check whether your application renders templates written by users or tenants you do not fully trust.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["trusted-templates-only","scriban-not-used"],"who_is_affected":"Applications that let untrusted users write Scriban templates and run them on a shared server are exposed, because a small template can make the process run out of memory or CPU. Applications that only render templates written by their own developers, or that do not use Scriban, can skip it.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000732,"input_tokens":4661,"output_tokens":531,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124437':13A,16A '-2026':12A,15A '7.5.3':33B,71C 'alloc':97C 'allow':78C 'array':112C 'attack':99C 'author':49B,81C 'biginteg':114C 'builtin':35B,88C 'cancellationtoken':124C 'comparison':113C 'contain':72C 'cpu':8A,59B,86C 'crash':64B,125C 'cve':11A,14A 'dotnet':17B 'drive':56B 'engin':31B 'enough':62B 'exhaust':5A,75C,83C 'exponenti':117C 'format':106C 'function':118C 'guard':98C 'high':61B 'host':10A,25B,68B,131C 'huge':105C 'ignor':121C 'like':89C 'limit':46B 'limittostr':96C 'loop':45B 'looplimit':122C 'math.format':38B,90C 'memori':6A,57B,84C 'multi':19B,129C 'multi-ten':18B,128C 'multipl':115C 'net':29B 'packag':21B 'precis':107C 'recurs':119C 'regex.replace':39B,91C 'resourc':74C 'scriban':1A,22B,26B,69C 'self':24B 'self-host':23B 'sever':34B 'share':110C 'shared-structur':109C 'size':43B 'skip':42B,94C 'small':53B,102C 'specifi':108C 'stall':9A,66B,127C 'string.escape':41B,93C 'structur':111C 'submit':51B,101C 'templat':3A,30B,48B,54B,80C,103C 'tenant':20B,130C 'untrust':2A,79C 'use':60B,104C 'vulner':76C","nicknames":[],"mitigations":[],"who_affected":"Applications that let untrusted users write Scriban templates and run them on a shared server are exposed, because a small template can make the process run out of memory or CPU. Applications that only render templates written by their own developers, or that do not use Scriban, can skip it.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["dotnet","high","multitenant","package","scriban","selfhosted"],"campaign_type":null,"search_a":"'-124437':13A,16A '-2026':12A,15A 'cpu':8A 'cve':11A,14A 'exhaust':5A 'host':10A 'memori':6A 'scriban':1A 'stall':9A 'templat':3A 'untrust':2A","search_b":"'7.5.3':33B 'author':49B 'builtin':35B 'cpu':59B 'crash':64B 'dotnet':17B 'drive':56B 'engin':31B 'enough':62B 'high':61B 'host':25B,68B 'limit':46B 'loop':45B 'math.format':38B 'memori':57B 'multi':19B 'multi-ten':18B 'net':29B 'packag':21B 'regex.replace':39B 'scriban':22B,26B 'self':24B 'self-host':23B 'sever':34B 'size':43B 'skip':42B 'small':53B 'stall':66B 'string.escape':41B 'submit':51B 'templat':30B,48B,54B 'tenant':20B 'use':60B","search_c":"'7.5.3':71C 'alloc':97C 'allow':78C 'array':112C 'attack':99C 'author':81C 'biginteg':114C 'builtin':88C 'cancellationtoken':124C 'comparison':113C 'contain':72C 'cpu':86C 'crash':125C 'exhaust':75C,83C 'exponenti':117C 'format':106C 'function':118C 'guard':98C 'host':131C 'huge':105C 'ignor':121C 'like':89C 'limittostr':96C 'looplimit':122C 'math.format':90C 'memori':84C 'multi':129C 'multi-ten':128C 'multipl':115C 'precis':107C 'recurs':119C 'regex.replace':91C 'resourc':74C 'scriban':69C 'share':110C 'shared-structur':109C 'skip':94C 'small':102C 'specifi':108C 'stall':127C 'string.escape':93C 'structur':111C 'submit':101C 'templat':80C,103C 'tenant':130C 'untrust':79C 'use':104C 'vulner':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-10-24T09:12:51+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"disclosure@vulncheck.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124437","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124437","severity":null,"published_at":"2026-11-08T14:18:10+00:00","modified_at":"2026-11-08T14:18:10+00:00","first_seen_at":"2026-11-08T14:48:38+00:00","fetched_at":"2026-11-08T14:48:38+00:00","note":null}],"documents":[{"id":102058,"url":"https://github.com/scriban/scriban/security/advisories/GHSA-95w2-9mjq-6c74","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-24T09:12:51+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"},{"id":102059,"url":"https://www.vulncheck.com/advisories/scriban-before-7.5.3-denial-of-service-via-unguarded-builtins-and-recursion","title":"Third-party advisory: www.vulncheck.com","kind":"advisory","source":"nvd","publisher":"research","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":"Third-party advisory: www.vulncheck.com"}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}